What if a meteor destroys planet Earth? A straightforward, structured approach to managing risk on projects.

At the start of projects, around the time of getting the business case agreed, it can pay dividends to start taking a structured approach for managing risk. I thought I would outline a straightforward approach that can be applied on a variety of projects, in a variety of businesses. The approach falls into three sections. Firstly, the risk workshop, in which risks are identified. Secondly, risk analysis, in which the workshop output is examined. Thirdly, risk review, which embeds risk management into the regular review of the project's progress.

But before we go too far with risk management, we need to be clear what we mean by risk. A risk is an event that may or may not happen in the future, which if it does happen, will have a bearing on your project. What are dealing with is managing uncertainty.

At the risk workshop ask people to brainstorm risks. What could happen that will knock us off track? What are the problems we have with finance, the IT department, the supplier? When you feel you have captured the majority of risks, ask the team to score them in terms of likelihood of occurring and impact on the project. Many people score risks high, medium or low but I prefer scoring on a scale of 1 – 10. Likelihood and impact are the start of risk analysis and it is very productive to score risks in the workshop.

After the workshop, the risk analysis begins. It is not enough to add up crude scores for likelihood and impact to identify the 'biggest risk'. The analysis needs to verify the relative scoring and consider two more dimensions; mitigation and control. If the risk occurs, how can we mitigate it's effect on the project? Are there contingency arrangements that can be put in place, for example? Control is crucial – consider how effective your management controls are in giving you early warning that the risk is likely to occur? If you have identified a risk that your key supplier might fall victim of the recession, how close are you to them? Is your relationship good enough that they will give you fair warning? Perhaps that supplier should be attending the weekly project meeting.

Someone may chuck in a “what if a meteor destroys planet earth?” to which the only reasonable answer is “we all get destroyed too”. Focus on the risks that the project team can manage and control the impact of.

Embedding risk management into the ongoing management of the project means adding a risk review to the agenda of every project meeting. It can seem pedantic to trot out the risk log at each meeting, but it is an important part of staying on top of uncertainty. Consider each risk, is it still relevant? Has anything new emerged that needs to be captured? Check that scores for likelihood and impact are still reasonable. Review the effectiveness of management controls and mitigation options.

A structured approach to risk management provides organisations tackling project work a number of key benefits over and above effective management of the project in hand. Risk management provides a language for discussing difficulties – it can swiftly de-personalise challenges that need to be carefully thought through. Risks logs also provide an organisation with the means to learn from experience. It is our response to uncertainty that distinguishes our maturity.

The things I have learned from the places I have worked

In 20 years I have worked for 13 organisations. Around 8 years of that has been in IT departments and the remainder on 'business transformation programmes' or in Finance departments. Most of my time with the organisations below was working on specific projects, or phases of projects. The shortest time with an organisation was a 6 week interim management role, the longest was three years. Some roles have been concurrent – at one point I was freelancing for a bank and teaching at two colleges.

I decided to note one thing I learned at each organisation. In chronological order, here we go.

• Massive central government IT department
  I am interested in computer systems, but not in massive central government IT departments.
  
  
• Small-medium sized software company
  Good projects are delivered by good teams.
  
  
• Business transformation services arm of a foreign government
  I am not as clever as I think I am.
  
  
• Major TelCo
  Respect your colleagues, even if they do work in Marketing.
  
  
• Major Utility Company
  The way that big consultancies integrate themselves into their clients is astonishing in terms of scale, sophistication and cost.
  
  
• Partially privatised national governement service
  A hard boss can be a good boss.
  
  
• Mid-sized law firm
  There are two sides to every argument, often more.
  
  
• The Insurance and Investment division of a major bank
  Senior management positions aren't that much fun really.
  
  
• A College
  There is no money in teaching, and not a lot of teaching.
  
  
• A specialist music college
  I don't like teaching teenagers either.
  
  
• Another major bank
  You have to manage consultants pro-actively.
  
  
• A global leader in financial services
  Some people could never succeed in small companies.
  
  
• Yet another major bank
  Have the confidence of your recommendations.
  
  
• The IT division of a major bank
  Process means nothing without service.

What I have learned from all of this is that there are three things I think you need to get right with work. Firstly, you need to respect the organisation that you work for. You need to feel that working for the organisation that you work for is something that you can take a little pride in, and you have to be able to justify that. Secondly, you need to feel satisfied by the work that you do. You need to feel that, on balance, you are going home with a feeling of a job well done. You need to feel that the work you do and you attitude to it means your abilities are being used well and developed appropriately. Thirdly, you need to enjoy the company of the people that you work with. In 20 years, I can honestly say that I scored 3 out 3 very briefly, many years ago, but since then 2 out of 3 has been pretty rare. However, I am fortunate in that with few exceptions I have always worked with great people.

Taking the advice of a friend I have edited this post removing the names of organisaitons I have previously worked for. Although there is no offence intended, at all, you never know how people will read things and I don't want to come a cropper.